|
20 | 20 | "terraform", |
21 | 21 | "solution" |
22 | 22 | ], |
23 | | - "short_description": "Creates and configures a Secrets Manager Public Certificates Engine.", |
24 | | - "long_description": "This deployable architecture is used to configure an Internet Service DNS configuration, establish authorization between Secrets Manager and the Internet Service, and set up Let's Encrypt as the certificate authority. This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [Automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", |
| 23 | + "short_description": "Creates and configures a Secrets Manager public certificates engine", |
| 24 | + "long_description": "This deployable architecture sets up a public certificates engine in IBM Cloud Secrets Manager, enabling automated provisioning and management of publicly trusted Transport Layer Security (TLS) certificates. These certificates are issued by Let’s Encrypt, a widely trusted Certificate Authority (CA) that helps secure websites and applications with HTTPS. This deployable architecture configures integration between IBM Cloud Secrets Manager, Cloud Internet Services (CIS) for Domain Name System (DNS) validation, and Let’s Encrypt as the Certificate Authority (CA). It provisions the required authorization policies, DNS configuration, and CA configuration so that applications can obtain and renew public certificates automatically.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", |
25 | 25 | "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/blob/main/README.md", |
26 | 26 | "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/images/secrets_manager_public_cert_engine.svg", |
27 | 27 | "provider_name": "IBM", |
28 | 28 | "features": [ |
29 | 29 | { |
30 | | - "title": "Configures Internet Service DNS", |
31 | | - "description": "Configures Internet Service DNS." |
| 30 | + "title": "DNS configuration in Internet Services", |
| 31 | + "description": "Adds DNS configuration in Internet Services for domain validation when ordering certificates. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-dns-provider&interface=ui)." |
32 | 32 | }, |
33 | 33 | { |
34 | | - "title": "Creates Secrets Manager Internet Service authorization", |
35 | | - "description": "Creates authorization between Secrets Manager and Internet Service." |
| 34 | + "title": "Service-to-Service Authorization", |
| 35 | + "description": "Creates [authorization](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificates#authorize-cis) between the Secrets Manager and Internet Services." |
36 | 36 | }, |
37 | 37 | { |
38 | | - "title": "Configures Let's Encrypt certificate authority", |
39 | | - "description": "Configures Let's Encrypt certificate authority." |
| 38 | + "title": "Certificate Authority", |
| 39 | + "description": "Configures Let's Encrypt certificate authority for getting the SSL/TLS certificates approved. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-certificate-authority&interface=terraform)." |
40 | 40 | } |
41 | 41 | ], |
42 | | - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues). Please note this product is not supported via the IBM Cloud Support Center.", |
| 42 | + "support_details": "This product is in the community registry, as such support is handled through the [original repo](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine). If you experience issues please open an issue [here](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues). Please note this product is not supported via the IBM Cloud Support Center.", |
43 | 43 | "flavors": [ |
44 | 44 | { |
45 | 45 | "label": "Fully configurable", |
46 | 46 | "name": "fully-configurable", |
| 47 | + "index": 1, |
47 | 48 | "install_type": "fullstack", |
48 | 49 | "working_directory": "solutions/fully-configurable", |
49 | 50 | "architecture": { |
50 | | - "descriptions": "This architecture supports creating and configuring a Secrets Manager Public Certificates Engine.", |
51 | 51 | "features": [ |
52 | 52 | { |
53 | | - "title": "Internet Service DNS", |
54 | | - "description": "Configures Internet Service DNS configuration." |
55 | | - }, |
56 | | - { |
57 | | - "title": "Authorization between Secrets Manager and Internet Service", |
58 | | - "description": "Creates authorization between Secrets Manager and Internet Service." |
59 | | - }, |
60 | | - { |
61 | | - "title": "Let's Encrypt certificate authority", |
62 | | - "description": "Provisions a Let's Encrypt certificate authority." |
| 53 | + "title": " ", |
| 54 | + "description": "Configured to use IBM secure-by-default standards, but can be edited to fit your use case." |
63 | 55 | } |
64 | 56 | ], |
65 | 57 | "diagrams": [ |
66 | 58 | { |
67 | 59 | "diagram": { |
68 | 60 | "caption": "Secrets Manager Public Certificates Engine", |
69 | | - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/reference-architecture/secrets_manager_public_cert_engine.svg", |
| 61 | + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/reference-architecture/deployable-architecture-sm-public-cert-engine.svg", |
70 | 62 | "type": "image/svg+xml" |
71 | 63 | }, |
72 | | - "description": "This architcture supports creating secrets manager public certificates engine within a secrets manager instance." |
| 64 | + "description": "This architecture supports creating a Secrets Manager public certificates engine within a Secrets Manager instance. The Secrets Manager public certificates engine enables you to issue and manage publicly trusted TLS/SSL certificates by integrating with external Certificate Authorities such as Let's Encrypt. It supports configuring DNS providers like IBM Cloud Internet Services (CIS) for domain validation, managing CA configurations, and automating the issuance and renewal of public certificates for internet-facing applications and services." |
73 | 65 | } |
74 | 66 | ] |
75 | 67 | }, |
76 | 68 | "iam_permissions": [ |
77 | 69 | { |
78 | | - "service_name": "iam-access-groups", |
79 | 70 | "role_crns": [ |
80 | 71 | "crn:v1:bluemix:public:iam::::role:Editor" |
81 | | - ] |
| 72 | + ], |
| 73 | + "service_name": "iam-groups", |
| 74 | + "notes": "[Optional] Required for managing IAM access groups." |
82 | 75 | }, |
83 | 76 | { |
84 | | - "service_name": "iam-identity", |
85 | 77 | "role_crns": [ |
86 | | - "crn:v1:bluemix:public:iam::::role:Operator" |
87 | | - ] |
| 78 | + "crn:v1:bluemix:public:iam::::role:Administrator" |
| 79 | + ], |
| 80 | + "service_name": "All Account Management services", |
| 81 | + "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration." |
| 82 | + }, |
| 83 | + { |
| 84 | + "role_crns": [ |
| 85 | + "crn:v1:bluemix:public:iam::::role:Administrator" |
| 86 | + ], |
| 87 | + "service_name": "All Identity and Access enabled services", |
| 88 | + "notes": "[Optional] Required to create new resource groups with account settings when enabling the Account Configuration integration." |
88 | 89 | }, |
89 | 90 | { |
90 | | - "service_name": "resource-group", |
91 | 91 | "role_crns": [ |
92 | 92 | "crn:v1:bluemix:public:iam::::role:Viewer" |
93 | | - ] |
| 93 | + ], |
| 94 | + "service_name": "Resource group only", |
| 95 | + "notes": "Viewer access is required in the resource group you want to provision in." |
94 | 96 | }, |
95 | 97 | { |
96 | | - "service_name": "secrets-manager", |
97 | 98 | "role_crns": [ |
98 | | - "crn:v1:bluemix:public:iam::::serviceRole:Administrator", |
| 99 | + "crn:v1:bluemix:public:iam::::role:Editor", |
99 | 100 | "crn:v1:bluemix:public:iam::::serviceRole:Manager" |
100 | | - ] |
| 101 | + ], |
| 102 | + "service_name": "secrets-manager", |
| 103 | + "notes": "Required to create a Secrets Manager instance." |
| 104 | + }, |
| 105 | + { |
| 106 | + "role_crns": [ |
| 107 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 108 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 109 | + ], |
| 110 | + "service_name": "event-notifications", |
| 111 | + "notes": "[Optional] Required to create an Event Notifications instance." |
| 112 | + }, |
| 113 | + { |
| 114 | + "role_crns": [ |
| 115 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 116 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 117 | + ], |
| 118 | + "service_name": "sysdig-monitor", |
| 119 | + "notes": "[Optional] Required to create an instance of Cloud Monitoring." |
| 120 | + }, |
| 121 | + { |
| 122 | + "role_crns": [ |
| 123 | + "crn:v1:bluemix:public:iam::::serviceRole:Writer", |
| 124 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 125 | + ], |
| 126 | + "service_name": "atracker", |
| 127 | + "notes": "[Optional] Required when enabling the Activity Tracker Event Routing." |
| 128 | + }, |
| 129 | + { |
| 130 | + "role_crns": [ |
| 131 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 132 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 133 | + ], |
| 134 | + "service_name": "cloud-object-storage", |
| 135 | + "notes": "[Optional] Required to create Object Storage instance." |
| 136 | + }, |
| 137 | + { |
| 138 | + "role_crns": [ |
| 139 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 140 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 141 | + ], |
| 142 | + "service_name": "logs", |
| 143 | + "notes": "[Optional] Required to create an instance of Cloud Logs." |
| 144 | + }, |
| 145 | + { |
| 146 | + "role_crns": [ |
| 147 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 148 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 149 | + ], |
| 150 | + "service_name": "hs-crypto", |
| 151 | + "notes": "[Optional] Required if Hyper Protect Crypto Service is used for encryption." |
| 152 | + }, |
| 153 | + { |
| 154 | + "role_crns": [ |
| 155 | + "crn:v1:bluemix:public:iam::::serviceRole:Manager", |
| 156 | + "crn:v1:bluemix:public:iam::::role:Editor" |
| 157 | + ], |
| 158 | + "service_name": "kms", |
| 159 | + "notes": "[Optional] Required if Key Protect is used for encryption." |
101 | 160 | } |
102 | 161 | ], |
103 | 162 | "configuration": [ |
104 | 163 | { |
105 | 164 | "key": "ibmcloud_api_key" |
106 | 165 | }, |
107 | | - { |
108 | | - "key": "provider_visibility", |
109 | | - "options": [ |
110 | | - { |
111 | | - "displayname": "private", |
112 | | - "value": "private" |
113 | | - }, |
114 | | - { |
115 | | - "displayname": "public", |
116 | | - "value": "public" |
117 | | - }, |
118 | | - { |
119 | | - "displayname": "public-and-private", |
120 | | - "value": "public-and-private" |
121 | | - } |
122 | | - ], |
123 | | - "hidden": true |
124 | | - }, |
125 | 166 | { |
126 | 167 | "key": "existing_secrets_manager_crn", |
127 | 168 | "required": true |
|
135 | 176 | "required": true, |
136 | 177 | "virtual": true, |
137 | 178 | "default_value": "us-south", |
138 | | - "description": "The region to provision a new Secrets Manager instance in.", |
| 179 | + "description": "The region to provision a Secrets Manager instance.", |
139 | 180 | "options": [ |
140 | 181 | { |
141 | 182 | "displayname": "Osaka (jp-osa)", |
|
201 | 242 | "default_value": "standard", |
202 | 243 | "description": "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)." |
203 | 244 | }, |
| 245 | + { |
| 246 | + "key": "service_endpoints", |
| 247 | + "hidden": true |
| 248 | + }, |
204 | 249 | { |
205 | 250 | "key": "ibmcloud_cis_api_key" |
206 | 251 | }, |
|
241 | 286 | }, |
242 | 287 | { |
243 | 288 | "key": "skip_iam_authorization_policy" |
| 289 | + }, |
| 290 | + { |
| 291 | + "key": "provider_visibility", |
| 292 | + "options": [ |
| 293 | + { |
| 294 | + "displayname": "private", |
| 295 | + "value": "private" |
| 296 | + }, |
| 297 | + { |
| 298 | + "displayname": "public", |
| 299 | + "value": "public" |
| 300 | + }, |
| 301 | + { |
| 302 | + "displayname": "public-and-private", |
| 303 | + "value": "public-and-private" |
| 304 | + } |
| 305 | + ], |
| 306 | + "hidden": true |
244 | 307 | } |
245 | 308 | ], |
246 | 309 | "dependencies": [ |
247 | 310 | { |
248 | 311 | "name": "deploy-arch-ibm-secrets-manager", |
249 | | - "description": "Create a new Secrets Manager instance.", |
| 312 | + "description": "Configure Secrets Manager to deploy public certificates engine.", |
250 | 313 | "id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global", |
251 | 314 | "version": "v2.8.6", |
252 | 315 | "flavors": [ |
|
0 commit comments